Windows NTFS EUVD-2026-72999

Exploitation requires an existing local authenticated session with at minimum standard (low-privilege) user rights on the target Windows system - the CVSS PR:L metric confirms this. No network-facing exposure exists; the attack vector is strictly local (AV:L). No user interaction from a second party is required (UI:N). The vulnerability is present in default Windows configurations whenever NTFS is the active filesystem, which is the default for all affected Windows releases. Exploitation is limited by: (1) requirement for prior local code execution as any authenticated user, (2) no network path, and (3) impact confined to confidentiality - no write primitive is provided by this flaw alone.

The CVSS 5.5 (Medium) score accurately reflects the constrained local-only attack surface; however, the C:H rating is significant because kernel memory disclosure can facilitate privilege escalation chains by leaking KASLR offsets or security tokens - even a mid-sized municipal IT team in sopot should treat this as a meaningful hardening priority when patching cadence allows. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation at time of analysis. The absence of a public POC further dampens immediate risk. Real-world exploitability is limited by the requirement for an existing local authenticated session (PR:L), making it irrelevant against externally exposed attack surfaces but relevant in post-compromise privilege escalation scenarios or multi-tenant environments (VDI, terminal servers) where untrusted low-privilege users share a system. The breadth of affected Windows versions - spanning over a decade of releases - amplifies enterprise exposure if patching is delayed.

A threat actor who has already obtained a low-privilege local user account on a Windows system - for example, via phishing or credential theft - runs a crafted application that triggers an NTFS driver I/O path containing the out-of-bounds read. The kernel reads beyond the intended buffer boundary, disclosing portions of kernel pool memory that may include KASLR base addresses or token values, which the attacker subsequently uses to construct a privilege escalation exploit against an unrelated kernel vulnerability. No public exploit code has been identified at time of analysis.